Bugzilla – Bug 1216564
Missing directory /usr/share/ca-certificates for charon
Last modified: 2024-07-04 12:27:10 UTC
charon-nm is looking for certificates at /usr/share-ca-certificates, but this directory does not exist. Thus it can't validate a valid certificate for an IPSec/IKEv2 VPN server (does not find the GlobalSign root certificates). I solved the issue issuing the following command: sudo ln -s /var/lib/ca-certificates/pem /usr/share/ca-certificates
Hi Bjørn, would you please help to take a look at this issue? I'm not sure whether it is correct to assign it to you, please feel free to reassign whenever necessary, thanks.
(In reply to Chenzi Cao from comment #1) > Hi Bjørn, would you please help to take a look at this issue? I'm not sure > whether it is correct to assign it to you, please feel free to reassign > whenever necessary, thanks. Fairly sure this comes from Strongswan-nm -> moving to Strongswan bugowner
Hi, Could you please provide a reproducer for this? I will try to reproduce it locally
ping
Hi, since this is a VPN server we can't provide a test login due to our policies. I'm going to setup a test server using a similar certificate for testing purposes in the next two weeks. Is there a way to send the information privately?
You can email it to me at my work email, I suppose
Hi, Any progress on recreating the setup?
I'm assuming this bug is not an issue anymore? Please let me know if it's still the case. I'll go ahead and close it if there's no response in a few days time.
(In reply to Mohd Saquib from comment #8) > I'm assuming this bug is not an issue anymore? Please let me know if it's > still the case. I'll go ahead and close it if there's no response in a few > days time. Dear Modh Saquib, sorry for the late response. I couldn't allocate the resources for a test server. Thus you can close this bug if you can't reproduce and we will keep instructing our users to do the manual fix we mentioned.
Thanks.. I'll close it for now.
I came across this bug using MircoOS. The issue is that strongswan has a configure option --with-nm-ca-dir (see documentation https://docs.strongswan.org/docs/5.9/features/networkManager.html) which, if not otherwise set, defaults to /usr/share-ca-certificates which seems not to be the right place for SUSE. Should be fixable by adding --with-nm-ca-dir=/var/lib/ca-certificates/pem to the configure section of strongswan.spec , e.g. somewhere around line 306 of https://build.opensuse.org/projects/openSUSE:Leap:15.5:Update/packages/strongswan/files/strongswan.spec?expand=1. I hope that helps, I don't have a test server or anything to try this but analysis of source code suggests this is the root cause.